Merge pull request #5314 from natali-rs1985/T9018

vpp: T9018: Auto-enable promiscuous mode for interfaces with VLANs

3 files changed, 60 insertions, 0 deletions

diff --git a/python/vyos/vpp/control_vpp.py b/python/vyos/vpp/control_vpp.py
index 0746282de..5cad2a646 100644
--- a/python/vyos/vpp/control_vpp.py
+++ b/python/vyos/vpp/control_vpp.py
@@ -688,3 +688,16 @@ class VPPControl:
                 arc_name=arc_name,
                 feature_name='ip6-icmp-ra-punt',
             )
+
+    @_Decorators.api_call
+    def set_promisc(self, ifname: str, enable: bool = True) -> None:
+        """Set promiscuous mode for interface
+
+        Args:
+            ifname (str): name of an interface
+            enable (bool): enable or disable promiscuous mode
+        """
+        self.__vpp_api_client.api.sw_interface_set_promisc(
+            sw_if_index=self.get_sw_if_index(ifname),
+            promisc_on=enable,
+        )
diff --git a/smoketest/scripts/cli/test_vpp.py b/smoketest/scripts/cli/test_vpp.py
index 35150a74a..f78052f68 100755
--- a/smoketest/scripts/cli/test_vpp.py
+++ b/smoketest/scripts/cli/test_vpp.py
@@ -1527,6 +1527,9 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
         # Ensure that VPP process is active
         self.assertTrue(process_named_running(PROCESS_NAME))
 
+        # Cleanup
+        self.cli_delete(['interfaces', 'ethernet', interface, 'vif', vlan])
+
     def test_23_1_vpp_acl_subinterface(self):
         base_acl = base_path + ['acl', 'ip']
         vlan = '200'
@@ -1567,6 +1570,9 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
             list(acl_interfaces[0].acls)[: acl_interfaces[0].count], [acl_index]
         )
 
+        # Cleanup
+        self.cli_delete(['interfaces', 'ethernet', interface, 'vif', vlan])
+
     def test_23_2_vpp_acl_bond_with_vif(self):
         base_acl = base_path + ['acl', 'ip']
         base_bond = interfaces_path + ['bonding']
@@ -1718,6 +1724,36 @@ class TestVPP(VyOSUnitTestSHIM.TestCase):
         self.cli_delete(['vrf', 'name', mgmt_vrf])
         self.cli_commit()
 
+    def test_25_vpp_promisc_vlan(self):
+        # T9018: promiscuous mode must be enabled automatically when VLANs
+        # are configured on a VPP interface and disabled when removed.
+        vlan = '100'
+        address = '192.168.10.1/24'
+
+        self.cli_commit()
+
+        # Verify promisc is off initially
+        _, out = rc_cmd(f'sudo vppctl show hardware-interfaces {interface}')
+        self.assertNotRegex(out, r'flags:.*\bpromisc\b')
+
+        # Add VLAN sub-interface
+        self.cli_set(
+            ['interfaces', 'ethernet', interface, 'vif', vlan, 'address', address]
+        )
+        self.cli_commit()
+
+        # Verify promisc is enabled
+        _, out = rc_cmd(f'sudo vppctl show hardware-interfaces {interface}')
+        self.assertRegex(out, r'flags:.*\bpromisc\b')
+
+        # Remove VLAN sub-interface
+        self.cli_delete(['interfaces', 'ethernet', interface, 'vif'])
+        self.cli_commit()
+
+        # Verify promisc is disabled
+        _, out = rc_cmd(f'sudo vppctl show hardware-interfaces {interface}')
+        self.assertNotRegex(out, r'flags:.*\bpromisc\b')
+
 
 if __name__ == '__main__':
     unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on())
diff --git a/src/conf_mode/interfaces_ethernet.py b/src/conf_mode/interfaces_ethernet.py
index 40b7843be..9063bcd7c 100755
--- a/src/conf_mode/interfaces_ethernet.py
+++ b/src/conf_mode/interfaces_ethernet.py
@@ -48,6 +48,7 @@ from vyos.utils.dict import dict_set
 from vyos.utils.dict import dict_delete
 from vyos.utils.network import get_vrf_tableid
 from vyos.utils.process import is_systemd_service_running
+from vyos.vpp.config_deps import deps_bond_dict
 from vyos.vpp.config_verify import verify_vpp_remove_interface
 from vyos.vpp.control_vpp import VPPControl
 from vyos import ConfigError
@@ -192,6 +193,7 @@ def get_config(config=None):
             get_first_key=True,
             no_tag_node_value_mangle=True,
         )
+        ethernet['vpp_bond_members'] = deps_bond_dict(conf)
 
     # Protocols static arp dependency
     if 'static_arp' in ethernet:
@@ -494,6 +496,15 @@ def apply(ethernet):
 
         sync_vpp_lcp_vrf_tables(ethernet, vpp_api)
 
+        # VPP requires promiscuous mode to pass VLAN-tagged traffic;
+        # also keep it enabled for VPP bond members
+        needs_promisc = (
+            'vif' in ethernet
+            or 'vif_s' in ethernet
+            or ifname in ethernet.get('vpp_bond_members')
+        )
+        vpp_api.set_promisc(ifname, enable=needs_promisc)
+
     return None